@getstrata/core 0.5.60 → 0.5.61

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @getstrata/core changelog
 
+## 0.5.61
+
+HTMX HTML kernel gaps that sibling apps could not work around without weakening CSP or duplicating the framework.
+
+- `createSecurityHeadersMiddleware({ csp | htmlCsp | directives })` and `configureContentSecurityPolicy()` extend the HTMX baseline. Defaults now allow YouTube/Vimeo embeds, `https:` media, `data:`/`https:` images, the HTMX 2.0.4 indicator style hash, and a per-request nonce on `script-src`/`style-src`. API JSON stays `default-src 'none'`. Do not add `'unsafe-inline'` to `script-src`.
+- `configureWebErrorView` / `notFoundHtmlResponse()` render styled HTML 404/403/500 (app `errors/*.eta` or kernel chrome with `/assets/app.css`). Production 5xx messages do not leak stacks.
+- `EtaViewEngine` passes `Request` into `resolveLayoutData`. `configureWebLayoutData({ loadUser })` receives that request as the second argument. Layout data includes `cspNonce`.
+- `securedBindRouteModelByKey` treats a null model as `NotFoundError`. GET ETags are skipped for HTML and composite objects unless `etag: true`.
+- Login redirects keep `pathname + search` after a same-origin safe-path check (`/forum?page=2` → `/login?redirect=%2Fforum%3Fpage%3D2`).
+
 ## 0.5.60
 
 - `@getstrata/core/database/boundConnection` publishes `getBoundDatabaseConnection` and `resetBoundDatabaseConnection` on the JS entry (not only the types file). Tests can reset the bound pool after `closeDatabase()` without a postinstall patch.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.60 && git push origin v0.5.60`
+2. Tag a release: `git tag v0.5.62 && git push origin v0.5.62`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/http/contentSecurityPolicy.d.ts

@@ -0,0 +1,27 @@
+type CspDirectiveValue = string | string[] | false;
+interface ContentSecurityPolicyDirectives {
+    [directive: string]: CspDirectiveValue;
+}
+interface ContentSecurityPolicyOptions {
+    /** Full HTML Content-Security-Policy. Replaces the HTMX/SPA baseline. */
+    csp?: string;
+    /** Alias for `csp`. */
+    htmlCsp?: string;
+    /** Merge extra sources into the HTML baseline. `false` removes a directive. */
+    directives?: ContentSecurityPolicyDirectives;
+}
+interface ResolveContentSecurityPolicyOptions extends ContentSecurityPolicyOptions {
+    nonce?: string;
+}
+/** HTMX 2.0.4 default indicator CSS (line-continued string inside insertIndicatorStyles). */
+declare const HTMX_2_0_4_INDICATOR_STYLE_HASH = "'sha256-bsV5JivYxvGywDAZ22EZJKBFip65Ng9xoJVLbBg7bdo='";
+declare function generateCspNonce(): string;
+declare function configureContentSecurityPolicy(options: ContentSecurityPolicyOptions): void;
+declare function resetContentSecurityPolicyForTests(): void;
+declare function strictApiContentSecurityPolicy(): string;
+declare function serverHtmxContentSecurityPolicy(nonce?: string): string;
+declare function spaContentSecurityPolicy(nonce?: string): string;
+declare function resolveHtmlContentSecurityPolicy(options?: ResolveContentSecurityPolicyOptions): string;
+declare function resolveContentSecurityPolicy(response: Response, options?: ResolveContentSecurityPolicyOptions): string;
+export type { ContentSecurityPolicyDirectives, ContentSecurityPolicyOptions };
+export { configureContentSecurityPolicy, generateCspNonce, HTMX_2_0_4_INDICATOR_STYLE_HASH, resetContentSecurityPolicyForTests, resolveContentSecurityPolicy, resolveHtmlContentSecurityPolicy, serverHtmxContentSecurityPolicy, spaContentSecurityPolicy, strictApiContentSecurityPolicy, };

package/dist/core/http/requestMetaContext.d.ts

@@ -7,6 +7,7 @@ type RequestMeta = {
         message: string;
     } | null;
     csrfToken?: string;
+    cspNonce?: string;
 };
 declare const requestMetaContext: import("node:async_hooks").AsyncLocalStorage<RequestMeta>;
 declare function runWithRequestMeta<T>(meta: RequestMeta, callback: () => T | Promise<T>): T | Promise<T>;

package/dist/core/http/safeInternalPath.d.ts

@@ -0,0 +1,4 @@
+declare function sanitizeInternalPath(raw: string, fallback?: string): string;
+declare function safeInternalRedirectPath(request: Request, fallback?: string): string;
+declare function loginRedirectLocation(request: Request): string;
+export { loginRedirectLocation, safeInternalRedirectPath, sanitizeInternalPath };

package/dist/core/http/securedRouteModelBinding.d.ts

@@ -4,6 +4,8 @@ interface RouteModelAuthorization {
     resource: string;
     action: keyof Policy;
     requireIfMatch?: boolean;
+    /** Opt in (`true`) or out (`false`) of GET ETags. HTML and composites are off by default. */
+    etag?: boolean;
 }
 declare function securedBindRouteModel<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (id: number, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
 declare function securedBindRouteModelByKey<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (key: string, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;

package/dist/core/http/securityHeadersMiddleware.d.ts

@@ -1,3 +1,6 @@
+import type { ContentSecurityPolicyOptions } from "@getstrata/core/http/contentSecurityPolicy";
+import { configureContentSecurityPolicy } from "@getstrata/core/http/contentSecurityPolicy";
 import type { Middleware } from "./middleware";
-declare function createSecurityHeadersMiddleware(): Middleware;
-export { createSecurityHeadersMiddleware };
+declare function createSecurityHeadersMiddleware(options?: ContentSecurityPolicyOptions): Middleware;
+export type { ContentSecurityPolicyOptions };
+export { configureContentSecurityPolicy, createSecurityHeadersMiddleware };

package/dist/core/http/webErrorResponse.d.ts

@@ -1,5 +1,5 @@
 type FieldErrors = Record<string, string[]>;
 declare function normalizeFieldErrors(details: unknown): FieldErrors;
-declare function webErrorResponse(error: unknown, request?: Request): Response | null;
+declare function webErrorResponse(error: unknown, request?: Request): Promise<Response | null>;
 export type { FieldErrors };
 export { normalizeFieldErrors, webErrorResponse };

package/dist/core/view/etaViewEngine.d.ts

@@ -3,8 +3,9 @@ declare const DEFAULT_VIEWS_DIRECTORY: string;
 declare const DEFAULT_LAYOUT = "layouts/app.eta";
 interface RenderOptions {
     layout?: string | false;
+    request?: Request;
 }
-type LayoutDataResolver = () => Promise<Record<string, unknown>>;
+type LayoutDataResolver = (request?: Request) => Promise<Record<string, unknown>>;
 /**
  * Renders `.eta` files as HTML + Eta tags (`<% %>`, `<%= %>`, `<%~ include() %>`).
  * Pug class/attribute shorthand is rejected at render time.
@@ -15,5 +16,5 @@ declare class EtaViewEngine implements ViewEngine {
     constructor(viewsDirectory?: string, resolveLayoutData?: LayoutDataResolver);
     render(name: string, data?: Record<string, unknown>, options?: RenderOptions): Promise<string>;
 }
-export type { RenderOptions };
+export type { LayoutDataResolver, RenderOptions };
 export { DEFAULT_LAYOUT, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine };

package/dist/core/view/htmlResponse.d.ts

@@ -4,7 +4,6 @@ declare function htmlResponse(html: string, init?: {
 }): Response;
 declare function isHtmxRequest(request: Request): boolean;
 declare function redirectResponse(location: string, status?: number): Response;
-declare function notFoundHtmlResponse(body?: string): Response;
 declare function textResponse(body: string, init?: {
     status?: number;
 }): Response;
@@ -15,4 +14,4 @@ declare function xmlResponse(body: string, init?: {
 declare function rssResponse(body: string, init?: {
     status?: number;
 }): Response;
-export { htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, rssResponse, textResponse, xmlResponse, };
+export { htmlResponse, isHtmxRequest, redirectResponse, rssResponse, textResponse, xmlResponse };

package/dist/core/view/index.d.ts

@@ -1,5 +1,8 @@
+export type { LayoutDataResolver } from "./etaViewEngine";
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine } from "./etaViewEngine";
-export { htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, rssResponse, textResponse, xmlResponse, } from "./htmlResponse";
+export { htmlResponse, isHtmxRequest, redirectResponse, rssResponse, textResponse, xmlResponse, } from "./htmlResponse";
 export type { ViewEngine } from "./viewEngine";
+export type { WebErrorViewInput, WebErrorViewOptions } from "./webErrorView";
+export { configureWebErrorView, errorTemplateName, htmlErrorResponse, notFoundHtmlResponse, renderKernelErrorChrome, renderWebErrorHtml, } from "./webErrorView";
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "./webLayoutData";
 export { configureWebLayoutData, resolveWebLayoutData } from "./webLayoutData";

package/dist/core/view/viewEngine.d.ts

@@ -1,6 +1,7 @@
 interface ViewEngine {
     render(name: string, data?: Record<string, unknown>, options?: {
         layout?: string | false;
+        request?: Request;
     }): Promise<string>;
 }
 export type { ViewEngine };

package/dist/core/view/webErrorView.d.ts

@@ -0,0 +1,21 @@
+interface WebErrorViewInput {
+    status: number;
+    title: string;
+    message: string;
+    request?: Request;
+    errors?: Record<string, string[]>;
+}
+interface WebErrorViewOptions {
+    render?: (input: WebErrorViewInput) => Promise<string> | string;
+}
+declare function configureWebErrorView(options: WebErrorViewOptions): void;
+declare function resetWebErrorViewForTests(): void;
+declare function renderKernelErrorChrome(input: WebErrorViewInput): string;
+declare function errorTemplateName(status: number): string;
+declare function renderWebErrorHtml(input: WebErrorViewInput): Promise<string>;
+declare function htmlErrorResponse(input: WebErrorViewInput & {
+    status: number;
+}): Promise<Response>;
+declare function notFoundHtmlResponse(body?: string): Promise<Response>;
+export type { WebErrorViewInput, WebErrorViewOptions };
+export { configureWebErrorView, errorTemplateName, htmlErrorResponse, notFoundHtmlResponse, renderKernelErrorChrome, renderWebErrorHtml, resetWebErrorViewForTests, };

package/dist/entries/http/contentSecurityPolicy.js

@@ -0,0 +1 @@
+export * from "../../index.js";

package/dist/entries/http/requireWebAuthMiddleware.js

@@ -25,6 +25,39 @@ function requestPrefersJson(request) {
   return pathname.startsWith("/api/");
 }
 
+// ../../src/core/http/safeInternalPath.ts
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  if (looksLikeExternalTarget(raw)) {
+    return fallback;
+  }
+  return raw;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
 // ../../src/core/http/requireWebAuthMiddleware.ts
 function createRequireWebAuthMiddleware(auth) {
   return async (request, next) => {
@@ -35,8 +68,7 @@ function createRequireWebAuthMiddleware(auth) {
     if (requestPrefersJson(request)) {
       throw new UnauthorizedError;
     }
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
+    return Response.redirect(loginRedirectLocation(request), 302);
   };
 }
 export {